@polymorphism-tech/morph-spec 3.2.0 → 4.3.0

package/stacks/nextjs-supabase/.morph/standards/supabase-storage.md

@@ -1,148 +0,0 @@
-# Supabase Storage Standard
-
-> Stack: Next.js 15 + Supabase + .NET Backend
-
-## Core Rules
-
-- ALWAYS use RLS policies on storage.objects for access control
-- NEVER serve private files without signed URLs
-- ALWAYS validate file type and size before upload
-- Public buckets: anyone can read, still need auth for write
-- Private buckets: require signed URLs or authenticated access
-
-## Bucket Configuration
-
-```sql
--- Public bucket (avatars, logos)
-INSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
-VALUES ('avatars', 'avatars', true, 2097152, ARRAY['image/jpeg','image/png','image/webp']);
-
--- Private bucket (documents, reports)
-INSERT INTO storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
-VALUES ('documents', 'documents', false, 10485760, ARRAY['application/pdf','image/jpeg','image/png']);
-```
-
-| Setting | Public Bucket | Private Bucket |
-|---------|--------------|----------------|
-| Read access | Anyone via URL | Signed URL or auth required |
-| Write access | RLS policy required | RLS policy required |
-| Use case | Avatars, public images | Documents, reports |
-
-## Storage RLS Policies
-
-```sql
--- Users upload/view/delete in their own folder
-CREATE POLICY "user_upload" ON storage.objects FOR INSERT
-  WITH CHECK (bucket_id = 'documents' AND (storage.foldername(name))[1] = auth.uid()::text);
-
-CREATE POLICY "user_select" ON storage.objects FOR SELECT
-  USING (bucket_id = 'documents' AND (storage.foldername(name))[1] = auth.uid()::text);
-
-CREATE POLICY "user_delete" ON storage.objects FOR DELETE
-  USING (bucket_id = 'documents' AND (storage.foldername(name))[1] = auth.uid()::text);
-
--- Public bucket: anyone reads, auth users upload to own folder
-CREATE POLICY "public_read" ON storage.objects FOR SELECT
-  USING (bucket_id = 'avatars');
-
-CREATE POLICY "auth_upload_avatar" ON storage.objects FOR INSERT
-  WITH CHECK (bucket_id = 'avatars' AND (storage.foldername(name))[1] = auth.uid()::text);
-```
-
-## Path Naming Convention
-
-```
-{bucket}/{user_id}/{category}/{filename}
-avatars/{user_id}/profile.webp
-documents/{user_id}/invoices/2026-01-invoice.pdf
-```
-
-First folder segment = user_id (enables simple RLS). Use lowercase, hyphens, include extension.
-
-## Upload Patterns
-
-### Browser Upload (Next.js)
-
-```ts
-async function uploadFile(file: File, userId: string) {
-  if (file.size > 10 * 1024 * 1024) throw new Error("File too large");
-  const allowedTypes = ["application/pdf", "image/jpeg", "image/png"];
-  if (!allowedTypes.includes(file.type)) throw new Error("Invalid type");
-
-  const path = `${userId}/uploads/${Date.now()}-${file.name}`;
-  const { data, error } = await supabase.storage
-    .from("documents")
-    .upload(path, file, { cacheControl: "3600", upsert: false, contentType: file.type });
-  if (error) throw error;
-  return data.path;
-}
-```
-
-### Server Upload (.NET)
-
-```csharp
-public sealed class StorageService(Supabase.Client client, ILogger<StorageService> logger)
-{
-    private static readonly string[] AllowedTypes = ["application/pdf", "image/jpeg", "image/png"];
-
-    public async Task<string> UploadAsync(
-        string bucket, string path, Stream stream,
-        string contentType, CancellationToken ct = default)
-    {
-        if (!AllowedTypes.Contains(contentType))
-            throw new ValidationException($"Invalid content type: {contentType}");
-        var response = await client.Storage.From(bucket)
-            .Upload(stream, path, new FileOptions { ContentType = contentType, Upsert = false });
-        return response;
-    }
-}
-```
-
-## Download and Signed URLs
-
-```ts
-// Public bucket: direct URL
-const { data } = supabase.storage.from("avatars").getPublicUrl("user-id/profile.webp");
-
-// Private bucket: signed URL (time-limited)
-const { data } = await supabase.storage
-  .from("documents").createSignedUrl("user-id/report.pdf", 3600); // 1 hour
-
-// Download file content (returns Blob)
-const { data } = await supabase.storage.from("documents").download("user-id/report.pdf");
-```
-
-## Image Transformations
-
-```ts
-const { data } = supabase.storage.from("avatars").getPublicUrl("user-id/photo.jpg", {
-  transform: { width: 200, height: 200, resize: "cover", quality: 80 },
-});
-```
-
-| Parameter | Options | Default |
-|-----------|---------|---------|
-| `width` / `height` | 1-2500 px | original |
-| `resize` | cover, contain, fill | cover |
-| `quality` | 20-100 | 80 |
-| `format` | origin, avif, webp | origin |
-
-## File Validation
-
-| Check | Client-Side | Server-Side | Bucket Config |
-|-------|------------|-------------|---------------|
-| File size | `file.size` | Stream length | `file_size_limit` |
-| MIME type | `file.type` | Content-Type | `allowed_mime_types` |
-| Extension | File name | File name | -- |
-
-Always validate at all three levels. Client-side can be bypassed.
-
-## Common Mistakes
-
-| Wrong | Right | Why |
-|-------|-------|-----|
-| No RLS on storage.objects | Policies for each bucket | Anyone can read/write without policies |
-| Private files via public URL | `createSignedUrl()` | Private bucket returns 403 without auth |
-| User-provided filename as-is | Sanitize + timestamp prefix | Path traversal attacks, collisions |
-| `upsert: true` by default | `upsert: false` | Prevents accidental file overwrites |
-| Files without user folder | `{user_id}/...` path pattern | Cannot write simple RLS policies |

package/stacks/nextjs-supabase/.morph/templates/contracts.cs

@@ -1,173 +0,0 @@
-// ============================================================
-// CONTRACTS: {{FEATURE_NAME_TITLE}}
-// Stack: Next.js + Supabase + .NET API
-// Generated by MORPH Framework
-// Date: {{DATE}}
-// ============================================================
-
-#region Usings
-
-using System;
-using System.Collections.Generic;
-using System.Threading;
-using System.Threading.Tasks;
-
-#endregion
-
-namespace {{NAMESPACE}}.Application.Features.{{FEATURE_NAME_PASCAL}};
-
-#region Configuration
-
-/// <summary>
-/// Supabase configuration options.
-/// Bind from appsettings.json "Supabase" section.
-/// </summary>
-public sealed record SupabaseConfig
-{
-    public required string Url { get; init; }
-    public required string AnonKey { get; init; }
-    public required string ServiceRoleKey { get; init; }
-    public required string JwtSecret { get; init; }
-}
-
-#endregion
-
-#region Pagination
-
-/// <summary>
-/// Pagination query parameters. Use with [AsParameters] in Minimal API.
-/// </summary>
-public sealed record PaginationQuery(
-    int Page = 1,
-    int PageSize = 20)
-{
-    public int Offset => (Page - 1) * PageSize;
-}
-
-/// <summary>
-/// Paginated result wrapper.
-/// </summary>
-public sealed record PagedResult<T>(
-    List<T> Items,
-    int TotalCount,
-    int Page,
-    int PageSize)
-{
-    public int TotalPages => (int)Math.Ceiling(TotalCount / (double)PageSize);
-    public bool HasNext => Page < TotalPages;
-    public bool HasPrevious => Page > 1;
-}
-
-#endregion
-
-#region Repository Interfaces
-
-/// <summary>
-/// Generic repository interface for Supabase/PostgreSQL data access via Dapper.
-/// </summary>
-public interface IRepository<T, TId>
-{
-    Task<T?> GetByIdAsync(TId id, CancellationToken cancellationToken = default);
-    Task<List<T>> GetAllAsync(CancellationToken cancellationToken = default);
-    Task<PagedResult<T>> GetPagedAsync(PaginationQuery query, CancellationToken cancellationToken = default);
-    Task<TId> CreateAsync(T entity, CancellationToken cancellationToken = default);
-    Task UpdateAsync(T entity, CancellationToken cancellationToken = default);
-    Task DeleteAsync(TId id, CancellationToken cancellationToken = default);
-}
-
-#endregion
-
-#region Service Interfaces
-
-/// <summary>
-/// Service for managing {{FEATURE_NAME_PASCAL}} operations.
-/// </summary>
-public interface I{{FEATURE_NAME_PASCAL}}Service
-{
-    /// <summary>
-    /// Gets a {{FEATURE_NAME_PASCAL}} by its identifier.
-    /// </summary>
-    Task<{{FEATURE_NAME_PASCAL}}Dto?> GetByIdAsync(Guid id, CancellationToken cancellationToken = default);
-
-    /// <summary>
-    /// Gets paginated list of {{FEATURE_NAME_PASCAL}} items.
-    /// </summary>
-    Task<PagedResult<{{FEATURE_NAME_PASCAL}}Dto>> GetPagedAsync(PaginationQuery query, Guid userId, CancellationToken cancellationToken = default);
-
-    /// <summary>
-    /// Creates a new {{FEATURE_NAME_PASCAL}}.
-    /// </summary>
-    Task<{{FEATURE_NAME_PASCAL}}Dto> CreateAsync(Create{{FEATURE_NAME_PASCAL}}Request request, Guid userId, CancellationToken cancellationToken = default);
-
-    /// <summary>
-    /// Updates an existing {{FEATURE_NAME_PASCAL}}.
-    /// </summary>
-    Task UpdateAsync(Guid id, Update{{FEATURE_NAME_PASCAL}}Request request, Guid userId, CancellationToken cancellationToken = default);
-
-    /// <summary>
-    /// Deletes a {{FEATURE_NAME_PASCAL}}.
-    /// </summary>
-    Task DeleteAsync(Guid id, Guid userId, CancellationToken cancellationToken = default);
-}
-
-#endregion
-
-#region DTOs
-
-/// <summary>
-/// Data transfer object for {{FEATURE_NAME_PASCAL}}.
-/// </summary>
-public sealed record {{FEATURE_NAME_PASCAL}}Dto(
-    Guid Id,
-    string Name,
-    Guid UserId,
-    {{FEATURE_NAME_PASCAL}}Status Status,
-    DateTime CreatedAt,
-    DateTime? UpdatedAt
-);
-
-/// <summary>
-/// Request to create a new {{FEATURE_NAME_PASCAL}}.
-/// </summary>
-public sealed record Create{{FEATURE_NAME_PASCAL}}Request(
-    string Name
-    // Add other required fields
-);
-
-/// <summary>
-/// Request to update an existing {{FEATURE_NAME_PASCAL}}.
-/// </summary>
-public sealed record Update{{FEATURE_NAME_PASCAL}}Request(
-    string Name
-    // Add other updatable fields
-);
-
-#endregion
-
-#region Enums
-
-/// <summary>
-/// Status of a {{FEATURE_NAME_PASCAL}}.
-/// </summary>
-public enum {{FEATURE_NAME_PASCAL}}Status
-{
-    Draft = 0,
-    Active = 1,
-    Completed = 2,
-    Archived = 3,
-    // Error states
-    Failed = 100,
-    Cancelled = 101
-}
-
-#endregion
-
-#region Exceptions
-
-public sealed class {{FEATURE_NAME_PASCAL}}NotFoundException(Guid id)
-    : Exception($"{{FEATURE_NAME_PASCAL}} with ID {id} was not found.");
-
-public sealed class {{FEATURE_NAME_PASCAL}}AccessDeniedException(Guid id, Guid userId)
-    : Exception($"User {userId} does not have access to {{FEATURE_NAME_PASCAL}} {id}.");
-
-#endregion

package/stacks/nextjs-supabase/.morph/templates/contracts.ts

@@ -1,168 +0,0 @@
-// ============================================================
-// CONTRACTS: {{FEATURE_NAME_TITLE}}
-// Stack: Next.js + Supabase
-// Generated by MORPH Framework
-// Date: {{DATE}}
-// ============================================================
-
-// ----- Supabase Config -----
-
-export interface SupabaseConfig {
-  url: string;
-  anonKey: string;
-}
-
-// ----- API Client Types -----
-
-export interface ApiClientConfig {
-  baseUrl: string;
-  getAccessToken: () => Promise<string | null>;
-}
-
-export interface ApiError {
-  message: string;
-  code: string;
-  statusCode: number;
-  details?: Record<string, string[]>;
-}
-
-export type ApiResult<T> =
-  | { success: true; data: T }
-  | { success: false; error: ApiError };
-
-// ----- Pagination -----
-
-export interface PaginationQuery {
-  page?: number;
-  pageSize?: number;
-}
-
-export interface PagedResult<T> {
-  items: T[];
-  totalCount: number;
-  page: number;
-  pageSize: number;
-  totalPages: number;
-  hasNext: boolean;
-  hasPrevious: boolean;
-}
-
-// ----- Supabase Client Type Aliases -----
-// Generated by: supabase gen types typescript --project-id <id> > types/database.ts
-
-export type Tables<T extends keyof Database["public"]["Tables"]> =
-  Database["public"]["Tables"][T]["Row"];
-
-export type Insertable<T extends keyof Database["public"]["Tables"]> =
-  Database["public"]["Tables"][T]["Insert"];
-
-export type Updatable<T extends keyof Database["public"]["Tables"]> =
-  Database["public"]["Tables"][T]["Update"];
-
-// ----- Database Schema (placeholder - replace with generated types) -----
-
-export interface Database {
-  public: {
-    Tables: {
-      {{FEATURE_NAME}}: {
-        Row: {
-          id: string;
-          name: string;
-          user_id: string;
-          status: {{FEATURE_NAME_PASCAL}}Status;
-          created_at: string;
-          updated_at: string | null;
-        };
-        Insert: {
-          id?: string;
-          name: string;
-          user_id?: string;
-          status?: {{FEATURE_NAME_PASCAL}}Status;
-          created_at?: string;
-          updated_at?: string | null;
-        };
-        Update: {
-          id?: string;
-          name?: string;
-          user_id?: string;
-          status?: {{FEATURE_NAME_PASCAL}}Status;
-          created_at?: string;
-          updated_at?: string | null;
-        };
-      };
-    };
-    Views: Record<string, never>;
-    Functions: Record<string, never>;
-    Enums: {
-      {{FEATURE_NAME}}_status: {{FEATURE_NAME_PASCAL}}Status;
-    };
-  };
-}
-
-// ----- Feature Types -----
-
-export type {{FEATURE_NAME_PASCAL}}Status =
-  | "draft"
-  | "active"
-  | "completed"
-  | "archived"
-  | "failed"
-  | "cancelled";
-
-export interface {{FEATURE_NAME_PASCAL}} {
-  id: string;
-  name: string;
-  userId: string;
-  status: {{FEATURE_NAME_PASCAL}}Status;
-  createdAt: string;
-  updatedAt: string | null;
-}
-
-export interface Create{{FEATURE_NAME_PASCAL}}Input {
-  name: string;
-  // Add other required fields
-}
-
-export interface Update{{FEATURE_NAME_PASCAL}}Input {
-  name?: string;
-  // Add other updatable fields
-}
-
-// ----- Storage Types -----
-
-export interface StorageUpload {
-  bucket: string;
-  path: string;
-  file: File;
-  contentType?: string;
-}
-
-export interface StorageFile {
-  id: string;
-  name: string;
-  bucket: string;
-  path: string;
-  publicUrl: string;
-  size: number;
-  contentType: string;
-  createdAt: string;
-}
-
-// ----- Auth Types -----
-
-export interface AuthUser {
-  id: string;
-  email: string;
-  displayName: string | null;
-  avatarUrl: string | null;
-}
-
-export interface AuthSession {
-  user: AuthUser;
-  accessToken: string;
-  expiresAt: number;
-}
-
-// ----- Form Schemas (use with zod) -----
-// Define zod schemas in component files, not here.
-// This file is for type definitions only.

package/stacks/nextjs-supabase/.morph/templates/decisions.md

@@ -1,115 +0,0 @@
-# Architecture Decision Records - {{FEATURE_NAME_TITLE}}
-
-## ADR-001: {Decision Title}
-
-**Date:** {{DATE}}
-**Status:** Proposed | Accepted | Deprecated | Superseded
-**Deciders:** MORPH Agents, Developer
-
-### Context
-
-{Describe the context and problem that led to this decision}
-
-### Decision
-
-{Describe the decision made}
-
-### Consequences
-
-**Pros:**
-- {Positive consequence 1}
-- {Positive consequence 2}
-
-**Cons:**
-- {Negative consequence 1}
-
-**Risks:**
-- {Identified risk}
-
-### Alternatives Considered
-
-#### Option A: {Name}
-- Pros: {advantages}
-- Cons: {disadvantages}
-- **Rejected because:** {reason}
-
-#### Option B: {Name}
-- Pros: {advantages}
-- Cons: {disadvantages}
-- **Rejected because:** {reason}
-
----
-
-## ADR-002: Database Access Strategy
-
-**Date:** {{DATE}}
-**Status:** Accepted
-
-### Context
-
-Need to decide how the .NET API accesses Supabase PostgreSQL.
-
-### Decision
-
-Use Dapper with Npgsql for direct SQL queries. No EF Core.
-
-### Consequences
-
-**Pros:**
-- Full control over SQL queries
-- Better performance (no ORM overhead)
-- Direct access to PostgreSQL features (jsonb, pgvector, functions)
-- RLS policies apply naturally through connection
-
-**Cons:**
-- No automatic migrations (use Supabase CLI instead)
-- Manual SQL query writing
-- No change tracking
-
----
-
-## ADR-003: Auth Strategy
-
-**Date:** {{DATE}}
-**Status:** Accepted
-
-### Context
-
-Need authentication for both Next.js frontend and .NET API.
-
-### Decision
-
-Use Supabase Auth with @supabase/ssr on frontend. Validate JWT tokens in .NET API middleware.
-
-### Consequences
-
-**Pros:**
-- Single auth provider for both layers
-- RLS policies work automatically with auth.uid()
-- Built-in social login, magic links, email/password
-- No separate auth service to maintain
-
-**Cons:**
-- Coupled to Supabase ecosystem
-- JWT secret must be shared with .NET API
-
----
-
-## Template for New ADRs
-
-```markdown
-## ADR-XXX: {Title}
-
-**Date:**
-**Status:** Proposed | Accepted | Deprecated | Superseded
-
-### Context
-{Why is this decision needed?}
-
-### Decision
-{What was decided?}
-
-### Consequences
-**Pros:** {list}
-**Cons:** {list}
-```

package/stacks/nextjs-supabase/.morph/templates/dockerfile-api.dockerfile

@@ -1,38 +0,0 @@
-# ============================================================
-# Dockerfile: .NET 10 API ({{FEATURE_NAME_TITLE}})
-# Stack: Next.js + Supabase + .NET API
-# Generated by MORPH Framework
-# ============================================================
-
-# Stage 1: Build
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
-WORKDIR /src
-
-# Copy project file and restore dependencies
-COPY *.csproj .
-RUN dotnet restore
-
-# Copy source code and publish
-COPY . .
-RUN dotnet publish -c Release -o /app/publish --no-restore
-
-# Stage 2: Runtime
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS runtime
-WORKDIR /app
-
-# Copy published output
-COPY --from=build /app/publish .
-
-# Configuration
-ENV ASPNETCORE_URLS=http://+:8080
-ENV ASPNETCORE_ENVIRONMENT=Production
-
-# Expose port
-EXPOSE 8080
-
-# Health check
-HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-  CMD curl -f http://localhost:8080/health || exit 1
-
-# Entrypoint
-ENTRYPOINT ["dotnet", "Api.dll"]

package/stacks/nextjs-supabase/.morph/templates/dockerfile-web.dockerfile

@@ -1,48 +0,0 @@
-# ============================================================
-# Dockerfile: Next.js Frontend ({{FEATURE_NAME_TITLE}})
-# Stack: Next.js + Supabase
-# Generated by MORPH Framework
-# Requires: output: "standalone" in next.config.ts
-# ============================================================
-
-# Stage 1: Install dependencies
-FROM node:22-alpine AS deps
-WORKDIR /app
-COPY package.json package-lock.json ./
-RUN npm ci --omit=dev
-
-# Stage 2: Build application
-FROM node:22-alpine AS builder
-WORKDIR /app
-COPY --from=deps /app/node_modules ./node_modules
-COPY . .
-ENV NEXT_TELEMETRY_DISABLED=1
-RUN npm run build
-
-# Stage 3: Production runtime
-FROM node:22-alpine AS runner
-WORKDIR /app
-
-ENV NODE_ENV=production
-ENV NEXT_TELEMETRY_DISABLED=1
-
-# Create non-root user
-RUN addgroup --system --gid 1001 nodejs && \
-    adduser --system --uid 1001 nextjs
-
-# Copy build output
-COPY --from=builder /app/public ./public
-COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-
-# Switch to non-root user
-USER nextjs
-
-# Expose port
-EXPOSE 3000
-
-ENV PORT=3000
-ENV HOSTNAME="0.0.0.0"
-
-# Start server
-CMD ["node", "server.js"]